Unbounded Decompression Vulnerability in Kyverno by Nirmata

CVE-2026-122323

What is CVE-2026-122323?

Kyverno versions 1.11.0 through 1.19.2 possess an unbounded decompression vulnerability in the FetchSignatureBlob function, which allows attackers to exploit memory resources. By delivering specially crafted, highly compressed notary signature layers, an attacker can overwhelm the memory beyond the allowed maximum payload size, potentially causing out-of-memory (OOM) conditions in admission controllers, leading to service disruptions. Organizations using affected versions of Kyverno must monitor their environments and limit potential exploits from maliciously constructed gzip layers.

References